don't substitute binaries

Mic92 · Oct 14, 2023 · 7711514 · 7711514 · wmertens · Nov 16, 2023
1 parent f995ea1
commit 7711514
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/modules/sops/templates/default.nix b/modules/sops/templates/default.nix
@@ -90,11 +90,12 @@ in {
                 tpl = config.sops.templates.${name};
                 substitute = pkgs.writers.writePython3 "substitute" { }
                   (readFile ./subs.py);
-                subst-pairs = pkgs.writeText "pairs" (concatMapStringsSep "\n"
+                subst-pairs = pkgs.writeText "pairs" (flip (concatMapStringsSep "\n")
+                  (attrNames (filterAttrs (n: v: v ? format && v.format != "binary") config.sops.secrets))
                   (name:
                     "${toString config.sops.placeholder.${name}} ${
                       config.sops.secrets.${name}.path
-                    }") (attrNames config.sops.secrets));
+                    }"));
               in ''
                 mkdir -p "${dirOf tpl.path}"
                 (umask 077; ${substitute} ${tpl.file} ${subst-pairs} > ${tpl.path})